I’ll stress that merely having the security flaw isn’t being evil, but when fixing it, not fixing it on a platform that’s also affected (and was shown in the initial disclosure) is evil against the entire Internet, and against customers of the platform.